{"id":"CVE-2022-31008","title":"rabbitmq-server: URI encryption with predictable secret seed (CVE-2022-31008)","summary":"A flaw was found in RabbitMQ. The shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. In certain exceptions related to Shovel …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-337","CWE-330","CWE-335"],"vendor":"Red Hat","product":"rabbit_common","affected":["rabbit_common >= 3.10.0, < 3.10.2","rabbit_common >= 3.9.0, < 3.9.18","rabbit_common >= 3.8.0, < 3.8.32"],"patched":["rabbit_common 3.10.2","rabbit_common 3.9.18","rabbit_common 3.8.32"],"published":"2022-10-05","updated":"2026-10-20","sourceUpdated":"2026-10-20T08:38:48+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-31008.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-31008.json"},{"url":"https://access.redhat.com/security/cve/CVE-2022-31008"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2141397"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31008"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31008"},{"url":"https://github.com/rabbitmq/rabbitmq-server/pull/4841"},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8"},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/c22e1cb20e656d211e025c417d1fc75a9067b717"},{"url":"https://github.com/advisories/GHSA-v9gv-xp36-jgj8"}],"tags":["csaf","vex","red-hat","ghsa","erlang","score-dispute"],"epss":0.00397,"epssPercentile":0.33789,"ecosystem":"erlang","scores":{"vendor":7.5,"ghsa":5.5},"ingestedAt":"2026-06-30T17:40:12.494Z","slug":"CVE-2022-31008","body":"## Overview\n\nA flaw was found in RabbitMQ. The shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. In certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-31008.json)\n\n**rabbitmq-server: URI encryption with predictable secret seed** — rated Moderate by Red Hat. Released 2022-10-05, updated 2026-10-20.\n\nNot affected:\n\n- Red Hat OpenStack Platform 13 (Queens)\n- Red Hat OpenStack Platform 16.1\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.0\n\n## Remediation\n\nRefer to the advisory for fix availability.\n\n## Package advisory (CVE-2022-31008)\n\nAffected packages:\n\n- `rabbit_common >= 3.10.0, < 3.10.2`\n- `rabbit_common >= 3.9.0, < 3.9.18`\n- `rabbit_common >= 3.8.0, < 3.8.32`\n\nPatched in:\n\n- `rabbit_common 3.10.2`\n- `rabbit_common 3.9.18`\n- `rabbit_common 3.8.32`\n\nSource: https://github.com/advisories/GHSA-v9gv-xp36-jgj8","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":225681,"id":"CVE-2022-31008","ts":1792498354333,"field":"cvss","old":"5.5","new":"7.5"},{"seq":225680,"id":"CVE-2022-31008","ts":1792498354333,"field":"severity","old":"medium","new":"high"}]}